DEA-C01 · Question #238
A company uses an Amazon Redshift cluster as a data warehouse that is shared across two departments. To comply with a security policy, each department must have unique access permissions. Department…
The correct answer is A. Group tables and views for each department into dedicated schemas. Manage permissions at the. By organizing each department's tables and views into its own schema (for example, dept_a and dept_b), you can grant usage and object privileges at the schema level. Department A's role gets USAGE on schema dept_a and the necessary SELECT rights there (and no rights on dept_b)…
Question
A company uses an Amazon Redshift cluster as a data warehouse that is shared across two departments. To comply with a security policy, each department must have unique access permissions. Department A must have access to tables and views for Department A. Department B must have access to tables and views for Department B. The company often runs SQL queries that use objects from both departments in one query. Which solution will meet these requirements with the LEAST operational overhead?
Options
- AGroup tables and views for each department into dedicated schemas. Manage permissions at the
- BGroup tables and views for each department into dedicated databases. Manage permissions at
- CUpdate the names of the tables and views to follow a naming convention that contains the
- DCreate an IAM user group for each department. Use identity-based IAM policies to grant table
How the community answered
(21 responses)- A71% (15)
- B10% (2)
- C14% (3)
- D5% (1)
Explanation
By organizing each department's tables and views into its own schema (for example, dept_a and dept_b), you can grant usage and object privileges at the schema level. Department A's role gets USAGE on schema dept_a and the necessary SELECT rights there (and no rights on dept_b), and vice versa for Department B. Because both schemas live in the same database, analysts can still run cross-department queries by schema-qualifying objects, and you avoid the extra complexity of multiple databases or intricate IAM policies.
Topics
Community Discussion
No community discussion yet for this question.